Status: Resolved
Observed: 2026-10-12
Affects: TELUS T3200M gateway, any Wi-Fi client

One device drops off the home SSID mid-session and then reports the correct password as “incorrect” on every attempt. All other devices keep working fine.

The gateway's SmartSteering (band steering) disassociated the client from one band via a BSS Transition Management frame (“Disassociation Imminent”), and the wireless daemon kept corrupted auth state for that client. Every subsequent WPA 4-way handshake is dropped with Reason: 2=PREV_AUTH_NOT_VALID or Reason: 15=4WAY_HANDSHAKE_TIMEOUT, which NetworkManager reports as WRONG_KEY: the “incorrect password” prompt. The stored password was correct the whole time.

Already-connected devices are unaffected because they never re-run the handshake. “Other devices work” does not rule this out.

From the affected device (on a hotspot if needed):

nmcli device wifi list          # confirm the SSID is broadcasting
journalctl -b --no-pager | grep -E "wlo1.*(Reason|deauth|WRONG)"

The signature in logs: WNM: Disassociation Imminent (the AP initiated the disconnect), then PREV_AUTH_NOT_VALID or 4WAY_HANDSHAKE_TIMEOUT followed by WRONG_KEY. The device associates fine but dies during the handshake and never reaches DHCP, so IP-layer fixes are irrelevant. Connecting happily to a phone hotspot while failing the home SSID is itself strong evidence the fault is router-side.

1. **Do not retype the password first.** Check the stored one: ''nmcli --show-secrets connection show <ssid> | grep psk''. Re-entering a mistyped password while the router's auth state is still broken keeps failing after the router is fixed and looks identical.
2. **Power-cycle the gateway**: unplug ~30 seconds, plug back, wait for the SSID to reappear.
3. Reconnect: ''nmcli --ask connection up <ssid>''.
4. If it still fails: check the gateway admin UI (''http://192.168.1.254'') for a paused or blocked device, and confirm wireless security is still WPA2 rather than WPA3/transition or "PMF required".

# force the 2.4 GHz radio (rule out a band with broken auth state)
nmcli con mod <ssid> 802-11-wireless.bssid <bssid>
 
# connect as a "new device" (rule out per-MAC blocking)
nmcli con mod <ssid> 802-11-wireless.cloned-mac-address random
 
# revert afterwards
nmcli con mod <ssid> 802-11-wireless.bssid "" \
    802-11-wireless.cloned-mac-address "" 802-11-wireless-security.pmf 0

Disable SmartSteering on the T3200M to remove the trigger: admin UI > Wireless Setup > SmartSteering > Disable > Apply. Costs: the gateway may split the SSID into -2.4G and -5G variants (rename both back to the same name and passphrase so devices pick their own band), and paired Wi-Fi extenders can be factory-reset by the change.

• Troubleshooting Log
• WiFi Power Save Issues
• Network Connectivity Issues
• Return to wiki home